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Remote state preparation is the variant of quantum state teleportation in which the sender knows 
the quantum state to be communicated. The original paper introducing teleportation established 
minimal requirements for classical communication and entanglement but the corresponding limits 
for remote state preparation have remained unknown until now: previous work has shown, however, 
that it not only requires less classical communication but also gives rise to a trade-off between these 
two resources in the appropriate setting. We discuss this problem from first principles, including 
the various choices one may follow in the definitions of the actual resources. 

Our main result is a general method of remote state preparation for arbitrary states of many 
qubits, at a cost of 1 bit of classical communication and 1 bit of entanglement per qubit sent. 
In this "universal" formulation, these ebit and cbit requirements are shown to be simultaneously 
optimal by exhibiting a dichotomy. Our protocol then yields the exact trade-off curve for memoryless 
sources of pure states (including the case of incomplete knowledge of the ensemble probabilities), 
based on the recently established quantum-classical trade-off for visible quantum data compression. 
A variation of that method allows us to solve the even more general problem of preparing entangled 
states between sender and receiver (i.e., purifications of mixed state ensembles). 

The paper includes an extensive discussion of our results, including the impact of the choice of 
model on the resources, the topic of obliviousness, and an application to private quantum channels 
and quantum data hiding. 

Keywords: Entanglement, teleportation, trade— off, cryptography, large deviations. 



I. INTRODUCTION 

Teleportation implements the transmission of a 
quantum bit (1 qubit) by sending two classical bits (2 
cbits), while using up quantum correlation amounting to 
one bit of entanglement (1 ebit) - although a descrip- 
tion of this state would require an infinite number of 
cbits, even when assisted by unlimited classical corre- 
lation. What is more, in teleportation this description 
is not needed at all: both the Sender and the Receiver 
act physically on the state (i.e. by quantum operations: 
completely positive and trace preserving linear maps), 
and the process can be used to transmit parts of entan- 
gled states faithfully. This and the phenomenon of dense 
coding 4] prove that one cannot do with less than these 
resources: both 2 cbits and 1 ebit are necessary. 
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However, allowing the Sender knowledge of the state 
to be communicated changes the task to what is now 
known as remote state preparation (r.s.p.) {35. 36, 42], 
and here two new phenomena occur: in JtI it is shown 
that at the cost of possibly spending more entanglement 
one can reduce the classical communication to 1 cbit per 
qubit in the asymptotics; and there is a trade-off between 
the classical and the quantum resources needed, of which 
and [U provide bounds. In the present work we put 
these results into their definite form by proving a formula 
for the exact trade-off curve and by improving on the 
result of 7] to use only 1 cbit and 1 ebit per qubit. 

By a protocol for remote state preparation (r.s.p.) we 
shall mean a procedure involving two parties, a Sender 
who is given a description of a state p € X <Z S{JC) 
from a subset X of the state set S{IC) of the Hilbert 
space /C, and a Receiver who have access to a number of 
resources (both forward and backward classical commu- 
nication, entanglement, shared randomness or others). 
The protocol prescribes how to use these in a sequence 
of steps (based on the previous exchange of messages in 
the protocol, and on p for the Sender), resulting in a state 
p held by the Receiver. The dimension D = dim/C will. 
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in the entire following discussion be the principal asymp- 
totic parameter (i.e., one should think of it as large). 

We shall say that the protocol is (deterministic) exact 
ii p = p for all choices of p G X. 

It is said to have fidelity F if for all p G X, F{p, p) > 
F, with the mixed-state fidelity [H F{p,a) = 

\\y/py/^\\l = Tr (yT^^V^)^- (Note t^^t for F = 1 this 
is the same as an exact protocol.) 

A notion in between these two is a probabilistic exact 
protocol with error e: this means that the protocol ad- 
ditionally produces a flag, accessible to both Sender and 
Receiver, which indicates "success" or "failure" such that 
for all p G X, Pr{ "failure" } < e and p = p if the flag is 
"success" ; p is arbitrary otherwise. (Note that such a 
protocol automatically has fidelity > 1 — e.) 

Sometimes we want to impose a probability distribu- 
tion P on X and we will also consider protocols which 
have average fidelity F, meaning 



J dP{p)F{p,p)>F. 



Varied as the parameters by which we judge the qual- 
ity of a protocol are, so are the ways to account for the 
use of resources: we will come back to this issue later 
('subsection lVI A|l . though the following example features 
not only various quality measures, but also some choices 
of resource accounting. For the moment we think only 
about protocols which terminate at a certain prescribed 
point and the resources are those needed to get to this 
point in the worst case p G X. 

Example 1 (Column method 0) The Sender is 
given an arbitrary pure state ip = \tp){4'\ (note that 
we use state synonymous with density operator; if 
we want to denote a state vector it will be ) on a 
D -dimensional space (in D = 2", i.e. n qubits), 
and that Sender and Receiver share sufficiently many 
maximally entangled states |$_d) ~ '^^^f=i\j)\i) 
Schmidt rank D, labelled 1, 2, . . . , 

The Sender performs the measurement 

on each of the K entangled states and records the out- 
come. Here ' denotes the complex conjugation with re- 
spect to the basis used to define $d. The probabil- 
ity of a Q clearly is the probability of a 1 is 1 — j^, 
hence the probability of K 1 's in a row (this will be called 
"failure") is 



Pr{ 'failure"} 



1 



1 

D 



K 



< exp 



K 
D 



Thus, if log K > log Z? -I- log log i , "failure" occurs with 
probability at most e. // this does not happen, there is 
at least one in the measurement results, and it requires 
log K cbits to communicate the label of the entangled state 
where it occurred to the Receiver. For definiteness, let 



us say that the Sender selects one position of outcome 
at random. Simple algebra shows that in this case the 
Receiver's reduced state is just ip. 

This is an example of a probabilistic exact protocol with 
asymptotic cost of classical communication of 1 cbit per 
qubit and success probability 1 — e. By ignoring the pos- 
sibility of failure, it becomes a fidelity 1 — e protocol. The 
protocol requires K log D ebits, which is exponential in 
the number of qubits. Most of this however can be recov- 
ered ("recycled") using back communication after com- 
pletion of the remote state preparation (see ^) such that 
only 0{\ogD) ebits are irrecoverably lost. 

Clearly, to make this method deterministic exact, one 
must not put a limit on the number of trials K (in which 
case the communication cost becomes infinite), or we 
must allow for a deterministic exact procedure in the case 
of "failure", e.g. teleportation. As this will increase the 
worst case communication cost to 2 cbits per qubit, we 
are motivated to also consider expected cbit cost, which 
in this example is 1 -f 2e per qubit. 

As an aside to this exposition, one can also consider 
making the task easier for the Receiver, by only requiring 
that he is able to simulate any measurement of which he 
is given a description, performed on the state of which the 
Sender is given a description: this is known as classical 
teleportation jl3j |. and though it is related to our subject 
it lies outside the scope of the present paper. 

The organisation of the rest of the paper is as fol- 
lows: in section^we present a general method of remote 
state preparation, which uses 1 cbit and 1 ebit per qubit 
asymptotically. It is based on an efficient state randomi- 
sation method (see also ;9] ) . In section IIIII it is shown 
that any universal high-fidelity protocol has to use 1 cbit 
and 1 ebit per qubit, asymptotically. The cbit bound is 
true even if unlimited quantum back communication is al- 
lowed, and the ebit bound is proved even in the presence 
of shared randomness. We proceed to derive the exact 
trade-off curve between ebits and cbits for an arbitrary 
ensemble of candidate states, in section IIVI using the 
recently established analogous but simpler trade-off in 
quantum data compression between qubits and cbits '29| . 
Section Ivl discusses the corresponding result if ensembles 
of pure entangled states between the Sender and the Re- 
ceiver are to be prepared: again, we can prove the exact 
trade-off between ebits and cbits. 

We conclude with a discussion of our findings and open 
questions in section IVII in particular considerations of 
the issue of obliviousness (cf. [3^ 1 and a discussion of 
the impact of certain slight changes in the model on our 
conclusions. 

Several appendices contain separate or more technical 
issues: in appendix ^ facts about Gaussian distributed 
vectors are related; appendix ^ contains the proofs for 
the central technical result, the state randomisation; in 
appendix[niit is shown that universal description of quan- 
tum states by qubits and cbits exhibits only a trivial 
trade-off between the resources: there is a dichotomy 
between full quantum with no classical information and 
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no quantum with infinite classical information. Facts 
about typical subspaces, used in various proofs, are col- 
lected in appendix ^ Appendix El contains thoughts 
on further operational links between the qubit/cbit and 
the ebit/cbit trade-off, based on a conjecture on the 
compressibility of mixed-state sources. Finally, in ap- 
pendix^ miscellaneous proofs are collected. 

Global notation conventions are: we use * for the Her- 
mitian adjoint, ^ for the transpose (in some given basis); 
exp and log are to basis 2 (for the natural basis we use 
e, and the natural logarithm is denoted In). 



II. UNIVERSAL R.S.P.: 
1 CBIT + 1 EBIT >- 1 QUBIT 

We begin with a result on universal (approximate) 
state randomisation by unitarics: 

Theorem 2 For Hilbert space Ti of dimension D and 
e > there exist 



unitaries Uk on TL such that for every state ip, 

K 

K 



k=l 



1: 1 



D 



D 



(1) 



where the closed interval to the right refers to the operator 
order. 

Proof Select the unitaries independently at random from 
the Haar measure on the unitary group. Observe that 
eq. Q says that for all pure states Lp and V', 



1 ^ 1 



k=l 



< 



D' 



Fix a ^~net A^, according to lemma0] Lemma|31below 
allows us to bound 



Pr |3(^,i/'e Al 



) 



f20D 



iD 



exp —K 



With triangle inequality for the trace norm we finally get 



< 2 



4D 



exp —K 



24 /' 



so if K is as large as stated in the theorem there exist 
Ui, . . . , Uk such that eq. Q is true. □ 



The probabilistic and geometrical facts used in the above 
proof are contained in the following lemmas. The first is 
applied in the above proof with p = I but the general 
version is used later on. 

Lemma 3 Let p be a pure state, P a rank p projector 
and let {Uk)^^i be an i.i.d. sequence of U{D)-valued 
random variables, distributed according to Haar measure. 
Then, for < e < 1, 



< 2 exp 



£2 

6 



Proof. In appendix IbI 



Lemma 4 Let TL be a Hilbert space of dimension D. 
Then there exists, for every e > 0, a set M of pure state 
vectors in H of cardinality 



\M\ < 



2D 



such that for every state vector \ip) d Ti. there exists a 
state vector \^) G M such that 



Such a set M we call e~net. 

Proof. In appendix □ 

A few words of interpretation: it is known 0, ^| that if 
e = 0, one needs K > D^, and this is tight as the ex- 
ample of the generalised Pauli (sometimes called Weyl) 
operators shows. We call a selection of unitaries as in 
the theorem "randomising" , because application of a ran- 
domly chosen Uk results in an almost maximally mixed 
state. Clearly, this has cryptographic applications, an 
exploration of which is to be found in our separate pa- 
per H. 

Let us now show how to use this result to build a re- 
mote state preparation protocol: first of all, given a pure 
state ijj, one can write down the family of operators 



Ak 



D 



K{l + e) 

K 



UkijUl (fc = l. 



^failure — 1 ^ / .^-k- 



E- 

k=l 



This is a POVM by virtue of theorem |21 
Protocol n (Description of at the Sender): 

1. The Sender measures the POVM {Ak) of the above 
description on her half of the entangled state 
and announces the result (either "failure" or A: = 
l,...,K). 
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2. If the message received is not "failure", say k, the 
Receiver applies the unitary Uj to his part of the 
state $D- 

Theorem 5 The above protocol realises remote state 
preparation for an arbitrary state lip) € JC exactly with 
a probability of failure of exactly < e. 

In particular, exact probabilistic r.s.p. with error e is 
possible using 

, 10 , , 201) , 

log D + 2 log \- log log cbits 

e e 



and 



logD ebits. 



Proof. It is straightforward to check that the protocol, in 
case it does not produce a failure, exactly prepares 
at the Receiver. 

For the probability assertions: the event k of the 
POVM [Ak) is triggered with probability exactly ^(Ij^i,) ■ 
Hence the probability of failure is 



1 - K- 



1 



= 1 - 



1 



K{l + e) " l + e l + e 

The remaining claims are easy consequences of this. □ 

Corollary 6 Probabilistic exact remote state preparation 
is possible with 1 cbit and 1 ebit per qubit, asymptotically. 

□ 



III. OPTIMALITY OF CBIT AND 
EBIT RESOURCES 

We will now show that both 1 ebit and 1 cbit per qubit 
are necessary asymptotically for universal r.s.p. protocols 
with high fidelity. More precisely, we assume a protocol 
like our protocol 11 in section|nl which takes as input the 
description of an arbitrary state -0 on a _D-dimensional 
space /C, uses an entangled state of Schmidt rank S, for- 
ward communication of one out of K messages, such that 
the output states p have fidelity F to the ideal ip. 

Regarding the communication resources, causality 
shows that K > FD is necessary, even if unlimited quan- 
tum back communication is allowed: this is because the 
mere capability to remotely prepare an orthogonal ba- 
sis of states with fidelity F clearly allows the Sender to 
transmit one out of D classical messages with probability 
at least F of correct decoding. Imagine now that Sender 
and Receiver follow the r.s.p. protocol with the modifi- 
cation that each forward communication is skipped and 
replaced by the Receiver guessing it at random. 

In this modification of the protocol, the probability of 
correct decoding clearly is > ^ , as the Receiver has only 
to guess the correct classical communication out of K. 
But the modified protocol involves no forward transmis- 
sion at all, hence the probability of correctly identifying 
the Sender's message — 1 out of D 



■ is < j^: this shows 



D — K- 

We have thus proved: 



Theorem 7 Any r.s.p. protocol with fidelity F requires 
classical communication of 

C = log K > log D + log F cbits, 

even if unlimited quantum back communication is al- 
lowed. □ 

Regarding the entanglement, we have the following re- 
sult of an extremely strong dichotomy: 

Theorem 8 Any r.s.p. protocol using an entangled state 
of Schmidt rank S < qD (q < F) requires classical com- 
munication of 

C > ^li^l^Z) - 0(logL») cbits, 
6 

even if unlimited shared randomness is available. 

On the other hand, there is a protocol with fidelity F > 
1 — e, which uses no entanglement at all (i.e., S — 1), 
and classical communication of 



C < ( 4 + log i I L> cbits. 



Thus, in the asymptotic limit, and with normalised re- 
sources E = log S/ log D and R = C/logD for the 
entanglement and communication rates, the rate point 
E = 1 marks the threshold between two drastically dif- 
ferent regimes: for E > 1, the classical communication 
rate i? = 1 is sufficient by corollary and necessary by 
theorem 13 For any entanglement rate E <1, theorem |H1 
shows that no finite classical communication rate is pos- 
sible: i? — !■ oo with D ^ oo. 

Thus, E >\ and R>1 hold simultaneously and both 
equalities can be achieved at the same time (theorem O, 
unless i? = oo in which case E = Q. I.e., there is only a 
trivial trade-off between ebits and cbits. 

Proof of theorem Consider any protocol, using a 
shared random variable v, so that the output state p 
is the mixture of the output states for the various values 
of V. Such a protocol clearly has average fidelity F > F, 
with respect to the uniform (i.e., unitarily invariant) dis- 
tribution on the pure states: 

F = I d|^)F(p,|V)(0|). 

Because of the linearity of the pure state fidelity in p, F is 
the probabilistic average of the fidelities F^, of the proto- 
col for the value v of the shared random variable. Hence 
there exists a v such that F^, > F, and we can consider 
a new protocol, without shared randomness, which has 
the same fidelity as the original. 

Thus, w.l.o.g., we may assume a protocol of the form 
described in the first paragraph of this section, which uses 
only the entangled state <& and forward classical commu- 
nication. In general terms, it proceeds by the Sender 



5 



performing a measurement on her half of $ and commu- 
nicating the outcome m to the Receiver, who then ap- 
phes a quantum operation T„j to his half of <i>. Observe 
that after the Sender's measurement the state of the Re- 
ceiver is collapsed to a state supported on the support 
of the restriction of $, which is a space of dimension S. 
Thus, effectively, the Sender supplies the Receiver with 
a message m and a state ^ on an S'-dimensional system, 
from the combination of which an approximation of ^ 
is obtained: p = T'm(^). Once more using bilinearity of 
the pure state fidelity, we may assume that the choice of 
the pair (m, ^) from ip is deterministic, and that ^ is a 
pure state. (This no longer describes an r.s.p. protocol, 
where uncontrollable randomness due to measurements 
is the rule: what is important here is that this can only 
enhance the capabilities of the Sender.) 

We now invoke theorem |^ from appendix |0 which 
lower bounds the classical communication cost of such a 
quantum-classical state description: we obtain 

C>'-^D^Oilo,D), 
6 

which is our claim. 

Conversely, in the situation with no entanglement, pick 



By the monotonicity of the fidelity under partial traces, 
this implies the weaker condition 



an -s/ie-net M of cardinality at most (^^^^ 



2D 



, according 

to lemma 01 Clearly, a valid protocol is this: 

Given a state description of the Sender picks a 10) G 
Ai with fidelity 1 — e (because lemma 0] is strong enough 
for that) to tp, and sends the Receiver an identifier for (/>, 
which requires log|Al| cbits. □ 



IV. ENSEMBLE TRADE-OFF CURVE 

While in the previous sections we considered univer- 
sal r.s.p. (even though asymptotic, allowing any input 
state), in the present and following section we want to 
look at ensemble asymptotics: we consider an ensemble 
of quantum states £ = {|V'i):Pi} on the Hilbert space Ti. 
of dimension d, and are interested in r.s.p. of the ensem- 
ble {\ipi),pi} on Ti**", with states and probabilities 

\^i) = IV-ii) «)••■«) IV'iJ, 

PI =Ph-- -P^r,, 

I = ii . . .in, 

and for large n. The notation for letters (lower case) 
and blocks (upper case) is used throughout this and the 
following section. 

Note that even in the case that the ensemble contains 
all pure states on Ti., the asymptotics will capture only 
the product states in JC ~ 7Y^" , imlike the model of the 
previous sections. 

We shall be interested in protocols which have average 
fidelity F, i.e.. 



1 " — 



(3) 



fc=i 



^p/Tr(|V'/)(-0/|p/) 



> F. 



(2) 



which we will find useful at times. 

Note that by considering average fidelities as we do 
here, shared randomness becomes automatically useless, 
because we aim to prepare pure states with high fidelity 
(compare the proof of theorem (S)). 

On block-length n, a protocol for r.s.p. uses a maxi- 
mally entangled state $_d of Schmidt rank D shared be- 
tween Sender (A) and Receiver (B). We consider here 
protocols which use only forward communication: their 
general form is described by a measurement POVM de- 
pending on /, = (Mj )j with j running over a set 
{1, . . . , K}: after performing this POVM on her half of 
$D, the Sender communicates j, and the Receiver ap- 
plies a quantum operation Tj to his half of We write 
(M, T) to denote such a protocol, sometimes adding a 
subscript n to indicate the block-length. 

The resources used are defined, in a way similar to (29|, 
as the entanglement rate 

esupp(M,r) := -logD, 
n 

and the communication rate 

csupp (M,r) := -\ogK. 

n 

(The notation is meant to remind one of "support" , since 
what we count here is the number of bits necessary to 
support the entanglement and the classical messages, re- 
spectively.) We say that a rate pair {R,E) is achievable 
if for all e, (5 > there exists no such that for all n > no 
there are r.s.p. protocols (M,T)„ with fidelity 1 — e and 
resources 

csupp (M, T)<R + 5, 
esupp (M, T)<E + 5. 

This allows us to rigorously define the trade-off function 
E* by 

E*{R) = n\\n{E\{R,E) is achievable}. 

A similar trade-off is studied in between cbits and 
transmitted qubits instead of ebits, which is a visible cod- 
ing generalisation of the familiar Schumacher quantum 
data compression [s^ [s^]: such a protocol consists of 
a pair (£'„,£)„) of encoding and decoding maps. The 
encoding takes / to a combination of a quantum mes- 
sage supported on n qsupp (i?„ , £)„ ) qubits and a classi- 
cal message comprising n csupp [En, Dn) cbits, while the 
decoding is a quantum operation acting on these two, 
with the aim as before, to achieve a large average input- 
output fidelity. 
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Defining achievable rate pairs {R, Q) analogous to the 
above, and letting 

Q*{R) = niin{Q\{R,Q) is achievable}, 

we have the following single-letter formula for the 
quantum-classical trade-ofF (q.c.t.) curve: 

Theorem 9 (Hayden, Jozsa and Winter [29]) 

Q*{R)^ M{£,R) := mm {S( A : B\C)\S {A : C) < R} , 

(4) 

where the minimisation is over all tripartite states 

i 3 

for stochastic matrices p{j\i); j has a range of at most 
m + I if the ensemble consists of m states. 

S{A : C) = S{A) + S{C) - S{AC) and 
S{A : B\C) = S{AC) + S{BC) ~ S{ABC) - S{C), 

are the (conditional) quantum mutual information, de- 
fined via the von Neumann entropy S, referring im- 
plicitely to the state uj: S{AC) is the von Neumann en- 
tropy of UJ restricted to AC, etc. □ 

In brief, once an optimal channel p{j\i) is chosen, the 
scheme essentially works as sending part of the clas- 
sical encoding J = ji • ■ • jn (only typical) using the 
Reverse Shannon Theorem .10], and then Schumacher- 
compressing the induced "conditional" ensemble 

{ipi,q{I\J) = q{ii\ji) ■ ■■q{in\jn)}, with 

to its von Neumann entropy (note that the ensemble is a 
product of independent ensembles even though they are 
not all identical). 

For each point {R, Q) on the trade-ofF curve for the en- 
semble £ we can, with the method of the previous section, 
construct an asymptotic and approximate r.s.p. protocol 
using C — R -\- Q cbits and E — Q ebits: We only have 
to use theorem |S1 to remotely prepare the encoded state 
on Q qubits, using Q ebits and an additional Q cbits, all 
per qubit. 

We can summarise the finding as an upper bound on 
E*(R), in a strange implicit form: 

E*{R + Q*{R))<Q*{R). (6) 



Remark 10 Devetak and Berger happened to 

parametrise the q.c.t. curve for the uniform qubit ensem- 
ble. Using teleportation instead of our theorem [3| they 
obtained r.s.p. protocols using C -\- 2Q cbits and Q ebits. 



Using the chain rule S'(A : B\C)-^S{A : C) = S{A : BC), 
we can put together theorem Inland eq. ® to obtain that 

E*{R) < min{S'(yl : B\C)\S{A : BC) < R}. 

In fact, we shall show in a moment that equality holds 
here: 

Theorem 11 

E*{R) = N{£,R) := min{S'(^ : B\C)\S{A : BC) < R}, 

(7) 

where the minimisation is over all tripartite states uj as 
in eq. {3|). 

Before we prove this, we state a little lemma collecting 
some properties of TV: 

Lemma 12 iV is convex, continuous and strictly de- 
creasing in the interval where it takes finite positive val- 
ues, which is [S{B)\ S{A)\. R obeys the following addi- 
tivity relation for ensembles £i and £2' 

N{£i(E)£2,R) = mm{N{£i,Ri)-]-N{£2,R2)\Ri + R2 = R}- 

(8) 

Proof. In appendix^ □ 

Proof of theorem 1771 Only the direction ">" has to be 
proved: assume an r.s.p. protocol for block-length n and 
with average fidelity 

F = Ep/Tr(|V'/)(^/|p/) > 1-e. 

Let us describe the protocol again: the Sender performs 
a measurement on her half of n(E -\- S) EPR-pairs and 
sends the measurement result j (obtained with proba- 
bility p{J\I) and collapsing the Receiver's state to ajj) 
to the Receiver (using n{R -I- S) classical bits), who per- 
forms a quantum operation Tj on his half of the EPR- 
pairs. The state thus produced is pij and obviously 

p/ = Ej p(jV)p/ J ■ 

Now, the post-measurement state, including a classical 
system A to record /, can be written in the general form 

a = J2pi\I){I\^ ®J2p(^\^)''i,3 ® ' 
/ j 

where C is the classical system used for communicating 
j- 

Entropic quantities of this state are related to the re- 
sources required by the protocol: first of all, Sa{A : 
BC) < n{R + S) because in total n{R + S) bits are com- 
municated, and their information cannot be exceeded by 
the information in what the receiver eventually gets, by 
causality. Similarly, because all the afj are supported 
on the nE qubits which form the Receiver's half of the 
EPR-pairs, we get 

niE + S)> S„{B) > S„{B\C) > S„iA : B\C). 
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We may assume that the Tj do not affect the sys- 
tem C, and because (conditional) mutual informations 
are non-increasing under local quantum operations, we 
obtain that 



n{R + S) > Sp{A : BC), 
n{E + 5) > Sp{A : B\C), 



(9) 
(10) 



with the state 
P 



^p,|/)(/|^®^p(j|/)pf^.®b-)(j| 



c 



(Note that pjj = Tj{ai,j) for all I,j.) Our goal is now to 
switch in the latter expression to the ideal states |V'/)('0-r|j 
arguing that we retain high fidelity to p, and then invok- 
ing general continuity bounds for the entropy: 
More precisely, define 



I 

Then we can estimate 

\\n-p\ 



Ep01^)IMV'/l''®|j)(jf . 

3 



PI 



PI, 3 I 



Tv{\i^i){iji\pi) 



< < 2^/^, 

where in the second line we have used the inequality 
5II/0 — fill < \/^ — F{p, o") for states p, a 0|, and then 
concavity of the square root function. Because for states 
p, cr on a _D-dimensional system, ||p — cr||i < e < i, we 
have the Fannes inequality 0| \S{p) — S{a)\ < — elog 
we obtain that there exists a function /(e), vanishing as 
e 0, such that 

niR + 5)>SniA:BC)^nfie), (11) 
n{E + S)>Sn{A:B\C)-nf{e). (12) 

The reasoning is that the entropies of combinations of A, 
B and C relative to the states and p, see eqs. © and 
(|10|l . can be estimated against each other by the Fannes 
inequality, observing that Hilbert space dimensions are 
of the form X" with a constant X. 
Hence we get (letting S' = S + f{e)) 



n{E + 5') > iimi{S{A : B\C)\S{A : BC) < n{R 
= N{E'^-^,n{R + 5')) 
Now we invoke lemma IT21 to estimate further, 
1 



5')} 



E + S' > -N(£'^^ 
n 



,n{R + S')) 




-Y^N{£,R,) 



-E 

n ^ 



Rk = R + S' 



the second line by eq. lO, the third by convexity of N. 
Using the continuity of N with S' (which occurs with 
e,S ^ 0), we arrive at i? > N{£, R), as desired. □ 

Readers of will notice the similarity of the proofs 
of the lower bounds in theorems 1^ and [TTI Given that for 
the upper bound we use an operational transformation of 
a q.c.t. protocol into an r.s.p. protocol, one may wonder if 
there is not a proof of the optimality of this reduction by 
an inverse reduction of an r.s.p. protocol to a q.c.t. pro- 
tocol. We relate one such attempt in appendix IeI 

There are two generalisations of theorem |21 which we 
can transport to obtain more general versions of theo- 
rem ^2 the first is to lift the restriction to discrete en- 
sembles, which is not really necessary - it is shown in p9l | 
by suitable approximation (using in fact the net lemma^J 
that theorem |51 holds true for an arbitrary probability 
distribution p on the pure states of Ti.. This shows auto- 
matically that theorem^Jalso holds in the same form for 
general ensembles (in general with inf instead of min) . 

The second concerns the so-called arbitrarily varying 
sources (AVS): an ensemble is generally taken to repre- 
sent some partial knowledge about the states to be en- 
countered, and this model allows us to fine-tune this to 
even less knowledge: an AVS is a family of probability 
distributions Ps, s G S on the space of pure states, with 
the intention that at each time step each of the distribu- 
tions Ps can occur. One might want to think of an ad- 
versary choosing s" — si . . . s„, thus presenting a given 
protocol with the distribution of states 



Ps" = Ps 



''Ps 



A protocol (of either q.c.t. or r.s.p.) is said to have fidelity 
F if for all choices s" £ 5", 



dp,,.{^)F{m^\,p)>F, 



where p is the output state on input "0. 

It turns out that for q.c.t. there is still a trade-off 
in this case, and that Q*{R) is given by the trade-off 
for the worst-case ensemble distribution from the convex 
hull P = conv{ps\s G S} of the Ps'- 

Theorem 13 For an AVS {ps}s£S, the q.c.t. trade-off 
curve is given by 

Q*{R)^snpQ*{p,R), 

where Q*{p,R) is the trade-off of theorem\^ as a func- 
tion of cbit rate R and the ensemble distribution p, made 
explicit. □ 

This immediately implies, by the same reasoning, the 
corresponding theorem for remote state preparation: 

Theorem 14 For an AVS {ps}s£S, the r.s.p. trade-off 
curve is given by 

E*{R) = sup E*{p,R), 
peP 



8 



where E*{p, R) is the trade-off of theorem \ll\ as a func- 
tion of chit rate R and the ensemble distribution p, made 
explicit. □ 



In particular, dropping all restrictions, i.e. for the 
AVS with P — {all distributions} (which means that 
the adversary may pick an arbitrary product state for 
the protocol), we obtain the "ultimate" trade-off func- 
tions Q* and E*: these govern the asymptotic qubit/cbit 
and ebit/cbit cost of compressing and remotely prepar- 
ing blocks of arbitrary states. Because we know that 
Q*{R) for the uniform distribution dominates all other 
curves with fixed input distribution ( 29], theorem 6.1 
and corollary 9.2), we have Q*(i?) = Q*{R, uniform) and 
hence E* (i?) = E* {R, uniform) . For qubits we thus can 
plot E* thanks to the results of Devetak and Berger [2H 
(Fig.©. 



V. PREPARATION OF ENTANGLED STATES 

It is tempting to consider the generalisation of the pre- 
vious section to mixed state sources. Observing how- 
ever that our solution of the pure state case rested on 
the quantum-classical trade-off for pure state compres- 
sion |29l| — itself a generalisation of Schumacher's source 
coding |37j — we might be discouraged by the corre- 
sponding mixed-state compression being far from re- 
solved. A glimpse of this is provided in appendix^ but 
see a more detailed discussion in ^^nd references 

therein. 

Instead, we target a seemingly harder problem: the 
Sender (A) should remotely prepare an entangled state 
between the Receiver (B) and herself, drawn from an 
ensemble. Clearly, the Receiver in this way obtains the 
mixed state ensemble of the reduced states. 

In detail, assume an ensemble £ = {\ipi) ,Pi}i^i of 
pure entangled states generating the i.i.d. source 



Classical versus quantum resources: Arbitrarily varying qubit source 




R (obits) 



FIG. 1: The q.c.t. trade-ofF curve for qubits vs. chits accord- 
ing to Devetak and Berger |2lll (solid) and the implied r.s.p. 
trade-off for ebits vs. chits (broken). 



A word might be necessary to explain why there is 
no contradiction between this universal trade-off curve 
(which evidently exists not just for qubits, but for any 
qudits; to our knowlegde, however, it hasn't been worked 
out explicitly for d > 2), and the proof of the nonexis- 
tence of any finite trade-off in section llTTl This is because 
in the present section the task is much less ambitious: we 
only want to remotely prepare large blocks of (admittedly 
arbitrary) qubit states, i.e. a long product of pure states 
in small dimension. The set of product states however 
is much smaller than the set of all pure states on the 
large blocks. This fact is sufficient to allow an efficient 
trade-off between ebits (or qubits) and cbits. 



I = ii- . .in, 

PI =Pn ■ • ■Pi„- 

The protocols we consider are of a general form very sim- 
ilar to those in section IIVI they allow both parties to 
use a maximally entangled state of Schmidt rank D, 
and consist of a family of instruments 19] = {M^ )j 
[j = 1, . . . , M) for the Sender, i.e. each Mj is a com- 
pletely positive map, and their sum (over j) is a trace 
preserving map for every / — this conveniently cap- 
tures the notion of a (partial) measurement with a post- 
measurement state. Furthermore, there are quantum op- 
erations Tj for the Receiver. The states prepared in this 
way are 

3 

and as before we demand that the fidelity F > 1 — e, with 

^p/Tr((p/p/) > F. 
I 

And similarly, we call a rate pair (i?, E) achievable if for 
all e,(5 > and sufficiently large n there exist r.s.p. pro- 
tocols with 

-logAf <R + 5, 
n 

-logD <E + S. 
n 

Define the trade-off function for the ensemble £, 

E*{R) = mm{E\{R,E) achievable}. 

We start by describing a protocol to achieve the rate 
point with the smallest R allowed by causality (a different 
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proof for the achievability of the obit rate can be found 
in |lll | even though with a method that is very wasteful 
in terms of entanglement, much like the column method 
of example ^ : 

Proposition 15 There exists an r.s.p. protocol which 
achieves the rate pair 



E = S (iZPi^f^ ' 



with the Holevo quantity x of the Receiver's mixed state 
ensemble {pi,(pf}. 

Proof. Consider a string / = ii . . . i„ of type (i.e. relative 
letter frequencies) Q — see appendix^for details — , and 
construct (with S > 0) the conditional typical projector 
U'^B^sil) for ff = ® ■■■ ® ^t- By eq. for 
sufficiently large n, 

Tr(^fn;«^,(/)) >l-6. 

Construct also the typical projector 11 :— H"^- of the av- 
erage state p — J2i Q{'^)¥'f' by lemma 1^ for sufficiently 
large n, 

Tr(^f n^,,) > 1 - 6. 
Hence, if we define (for all / of type Q) 

:=n;,,n;.,(/)^fn;.,(/)n;'^„ 

these operators have the properties 

Tr7r/>l-2e, (13) 
7ri<exp{~n{S{^''\Q)~5))Uls, (14) 

the latter is obtained by the definition of the condi- 
tional typical projector in appendix IdI here, S{(p^\Q) = 

E.Q»5(^f). 

Denoting the subspace onto which 11^ g projects by T, 
its dimension, by eq. (|D3p is bounded 



D diiaT <exp{n{S{p) + S)) . (15) 
Now, for the Haar measure dU on the unitarics on T, 

J dUUirjU* = (Tr7r/)-^n. 

Draw C/i, . . . , Uk i.i.d. according to the Haar measure. 
Then, according to lemma [TCI stated below. 



< 2Dcxp (-i^cxp(-n(x + 2(5)) 



(l-2e)e= 



with X = S{p) ~ S{f^\Q): because we can rescale the tt/ 
with the factor on the right hand side of eq. H14I) . Thus, 
by the union bound, there exist f/i, . . . , Uk such that for 
all / of type Q, 



1 



D 



^-H<1- 



K ^ TrTT/ 

k 



1 



D 



-n. 



(16) 



if if 



^exp(r7.(x + 2(5)). 



(1 -h n log m -I- log £)) (^32^ 
The r.s.p. protocol now works as follows: the Sender, 
on getting /, determines its type Q and sends it to the 
Receiver. If Q\\i > S, the protocol aborts here (this 
happens with probability < e if n is sufficiently large, by 
the law of large numbers). For type Q they have agreed 
on a list of unitaries Ui, . . . , Uk as in eq. H16() : the Sender 
can construct the measurement POVM 



^failure 



D 



K{l + e)TTni 



UkirJU^, 



H 



A, 



and measures it (non-destructively) on the maximally 
entangled state $ on ig) . The outcome "failure" 
occurs with probability less than e, and in the case of out- 
come k the Receiver, on learning the value fc, can apply 
the unitary Uj : it is straightforward to check that in this 
case he and the Sender share a purification of tj^tt/. Be- 
cause of eq. (fT^ and the gentle measurement lemm a [TTI 
below, this state has high fidelity to iff, so by lU l39| | 
she can apply a unitary to her post-measurement state 
to obtain a high-fidelity approximation of iff^ . 

Clearly, this protocol has a high average fidelity. In 
terms of resources, it requires a logarithmic number of 
bits to communicate the type Q and 

logK <n{x{{Qi^),vf})+fiS)) 

to communicate the result of the measurement described 
above, with a function / which vanishes as (5 — > 0. By 
eq. l(T3|) . it uses 



ebits. With Fannes inequality (2^ for \\p ~ Q\\i < S, we 
obtain the claim. □ 

Lemma 16 ("Operator Chernoff bound" Let 

Xi,...,Xm be i.i.d. random variables taking values 
in the operators B{'H) on the D -dimensional Hilbert 
space H, < Xj < 1, with A = JEXj > al, and let 
< 77 < 1/2. Then 



Pi'i^-^pX,^[{l~7j)A;{l + ^)A]^ 



< 2Dexp -M 



arj 
2 In 2 



□ 
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Lemma 17 For a state p and an operator < X < 1, 
ifTr{pX) > I ~ e, then 



The main result of the present section is that this is 
essentially optimal: 

Theorem 18 For the ensemble £ — {pi,ipi\ of pure bi- 
partite states and R> 0, 

E*{R) = N{£,B) := mm{S{B\C) \ S{X : BC) < R}, 

where the entropic quantities are with respect to the state 
oj, and minimisation is over all A-partite states u as fol- 
lows: 



® ^t"" ® Y.P(mj){jf, (17) 



with a classical channel p{j\i). 



E' (ebits) 



E.P.S(^f) 




H(p.) 



R (cbits) 



FIG. 2: Schematic of the trade-off curve for an ensemble of 
entangled states. The shaded area is forbidden by causality 
and the curve begins at the point {x{{Pi ,vf}),S {^iPiff)) , 
due to the protocol of proposition 1151 It can never go below 
E = ^iPiS(ipf), which is reached at cbit rate R = H{p), as 
this is the very amount of entanglement in the ensemble. 

This theorem should be compared to the unentangled 
case, theorem ^2 to which it provides a pleasingly di- 
rect generalisation. We see that despite the fact that the 
theorem applies to ensembles of entangled states, regis- 
ter A does not appear in any of the entropic quantities 
involved. The trade-off curve is a function solely of the 
ensemble of mixed states at the Receiver. See Fig. El for 
a schematic view of the trade-off curve. 

Before giving the proof, we state a crucial lemma (com- 
pare lemma [T^ . which we prove in appendix IfI 

Lemma 19 iV is convex, continuous and strictly de- 
creasing in the interval [S{X : B); S{X)]. R obeys the 
following additivity relation for ensembles £i and £2 ■' 

N{£i (g) £2, i?) = min{iV(f iV(£2,i?2) + i?2 = R}- 

(18) 
□ 



Proof of theorem \TEl First, to show that, for fixed R, 
the pair {R,N{R)) is achievable, consider any channel 
q{j\i), and let Sender and Receiver perform the following 
procedure (where all information quantities we encounter 
refer to the state lu): 

In step one, the channel q" is simulated (using shared 
randomness) on the typical / by the Reverse Shannon 
Theorem 10, 41], using n{l{X : C) -|-(5) of forward com- 
munication, within average total variational distance e if 
n is large enough. 

Assuming that the channel is simulated ideally, we 
can proceed: with probability 1 — e, J = ji . . . j„ is typical 
for the distribution qj = X^iKPOl*): i-'^- if is the set 
of indices i such that ji — j, then 



nqj 



< S. 



Now proposition 1151 is used to remotely prepare the en- 
semble {q{i\j), ipi} on the block Xj, with the conditional 
distribution 

This requires 

<n{q,-^6)[x{{qm,vf})+S 



cbits, 



< n{q, + S) (S{J2 qm^f) + S) ebits 



In total, we use n{S{X : C) + S{X : B\C) + f{S)) cbits, 
and n{S{B\C) + f{&)) ebits, and the average fidelity can 
be made arbitrarily close to 1. Finally, the shared ran- 
domness can be disposed of, because the average fidelity 
is an average over it — hence there exists a value of the 
shared random variable such that the average fidelity is 
even larger. 

Now for the converse direction, that is a lower 
bound: if (i?, E) is achievable, then for sufficiently large n 
there exist protocols which use n{R-\-5) cbits and n{E-\-5) 
ebits, of fidelity 1 — e: 



where p/ is the output state for input /. Any protocol has 
the following form: the Sender performs a measurement 
on her half of n{E+5) EPR pairs, and then sends n{R+5) 
bits of classical message j to the Receiver. Conditioned 
on the classical message j, he then performs a decoding 
operation Tj on his system. The outcome is a state p/.j 
such that 



PI = ^P{j\I)Pi,. 



The post-measurement state, including a classical sys- 
tem recording /, can be written in the form 
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where system C is communicated, and with p/j = 
Tj{ljij). By causahty, S^{X : BC) < n{R + S). More- 
over, we can assume that the Receiver's operation Tj 
does not damage the C register since the contents of the 
register could be copied prior to the apphcation of Tj 



we have 



FiiPj.LO,) > ^q(/|j)(l - e/,,) =: 1 - e, 



Since T, cannot increase S{X : BC) by data processing, ^ow, because ipf^ is pure, the state if, must be separable 



however, we find that for the state 

/ j 
the inequality 

: BC) < n{R + 5) 

holds. Introducing 

^ = Y,pi\i){if ® ^f"" ® ^p(j|/)ij)of, 

we conclude that 

Sn{X ■.BC)<n{R + 5 + f{e)), 



(19) 



with some universal function / vanishing with e: this is 
because of our fidelity assumption on the protocol and 
the bihnearity of the pure state fidelity, F(n,p) > 1 — 
e. (Compare the analogous computation in the proof of 
theoremllll') 

To bound the entanglement, observe that because the 
Sender's measurement was on her half of n{E + 6) EPR 
pairs that the state lu^ = q{I\j)u!fj has support no 

larger than 2"(^+'^). (Note that pip{j\I) defines a joint 
distribution on / and j. We use q{I\j) and qj to denote 
the associated conditional and marginal distributions.) 
Therefore, for the state loxabCj 



SUB\C) 
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q,S{Lof) < n{E + S). 



If Bob's decoding operation Tj were guaranteed to be 
unitary we could conclude Sp{B\C) < n{E + 5). More 
generally, Tj can be decomposed into three steps: adjoin- 
ing an ancilla, applying a unitary and then tracing over 
the ancilla system. The first two steps leave the entropy 
invariant so without loss of generality, assume that con- 
ditioned on j. Sender and Receiver share a state uif^^ 
and that Tj = Tr^/. Our strategy will be to use the fact 
that the states (pf^ are pure to argue that the partial 
trace should not increase the entropy. 

First, we now have = pff- Let {ipi\pij\ipj) — 1 — 

ejj. We can choose an extension ipf^^ of ipj such that 
F{(pf^'^' ,ujff^') = 1 - e/j mill. By the concavity 



of the fidelity, we then conclude that for 



UJ-i 



ABB' 
1.3 ' 



across the AB - B' cut. Therefore, S{ipf^') > S{ipf). 
On the other hand, using the Fannes inequality and the 
concavity of its bound, we obtain 

n{E + 6)>J2q,S{ojf^') 

3 

>J2q,[S{^f^')-nfie,)] 

3 

>Y,q,S{^f)-nf{e), 
j 

for some universal function / vanishing with e. Hence, 

SniB\C)<n{E + 5 + f{e)). (20) 

Putting this together with eq. (|19|) . we get, with 6' = 
6 + /(e) and the definition of N, 

n{E + 6') > A^(f^",n(i? + y)). 

Now we can invoke lemma [T^ and obtain 

E + S'> -N(£'^'\n(R + 5')) 
n ' 

f 1 " 1 " 1 

I /c=l /c=l J 

> iV(£,i? + 5')- 
Finally, using continuity of N in i?, we obtain the result, 
E > N{£,R). 

□ 

VI. DISCUSSION 

In the following subsections we want to review what 
we have achieved, while pointing out open questions. 

A. Models and resources 

In the introduction we have mentioned various subtly 
different ways to define remote state preparation (deter- 
ministic exact, probabilistic exact, high fidelity; see next 
subsection for oblivious), as well as ways to account for 
the resources used (worst case and expected cost). 

Subsequently we have concentrated on probabilistic 
and high fidelity asymptotic protocols (for which worst 
case and expected cost coincide, as one can easily see). 
The justification of this choice is that it seems to be the 
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one best suited to the asymptotic considerations at our 
focus. 

However, as the following table shows, our conclusions 
are for the most part independent of the particulars of 
the model: 





Worst Case 


Expected 


Det. exact 


?> 1 ebit, 2 >?> 1 cbits 


1 ebit, 1 cbit 


Prob. exact 


1 ebit, 1 cbit 


High fidelity 


1 ebit, 1 cbit 


Oblivious 


1 ebit, 2 cbits 


Approx. obi. 


1 ebit, 1 cbit 



The entries "1 ebit, 1 cbit" derive their achievabil- 
ity from our protocol H (theorem \^ — directly in the 
cases "Probabilistic exact" , "High fidelity" and "Approx- 
imately oblivious" (see the following subsection), and 
augmented by teleportation in the failure event for "De- 
terministic exact, Expected cost". The upper bound "1 
ebit, 2 cbits" is of course teleportation, which indeed is 
oblivious (see the following subsection) ; that in the obliv- 
ious case 2 cbits are indeed necessary was shown in [s^ . 

So, only the entry in the field "Deterministic exact, 
Worst case" is not entirely understood: in it is shown 
that an exact r.s.p. protocol for a single qubit requires at 
least 1 ebit and 2 cbits, just like teleportation. Whether 
the analogous statement for higher dimensions is true is 
unknown. 



B. Approximate obliviousness 

An r.s.p. protocol is called oblivious to the Sender [s^ 
if, like teleportation, it can be made into a quantum op- 
eration for her, which she can execute without knowing 
classically what state she is attempting to prepare. A 
protocol is called oblivious to the Receiver [sj if, again 
like teleportation, it leaks no information about the state 
being prepared beyond giving him a single specimen of 
it. In |3J| it was shown that if a deterministic exact pro- 
tocol for preparing states in dimension D is oblivious to 
the Receiver, then it must be oblivious to the Sender also, 
and must therefore, like teleportation, use at least logD 
ebits and 2 log 13 cbits. 

A similar penalty for receiver obliviousness exists even 
in a purely classical analog of r.s.p., namely the simu- 
lation of a noisy classical channel by noiseless forward 
classical communication (cbits) and shared randomness 
(rbits) between Sender and Receiver. The classical Re- 
verse Shannon Theorem gives a deterministic exact 
protocol for this task at an expected cbit cost approach- 
ing the simulated channel's classical capacity C in the 
limit of large block size, but it is not hard to show that for 
some channels any such exact efficient simulation must 

1) have a worst-case cost exceeding its expected cost, and 

2) must be non-oblivious to the Receiver. For example 



consider a binary symmetric channel with crossover prob- 
ability p and capacity C — 1+p log p+ {1—p) log( 1 —p). 
Note that such a channel, given a block of n inputs, 
has probability Pq = {I — p)" oi transmitting the whole 
block exactly, without crossovers, and of course any exact 
simulation of the channel must simulate this rare event 
with the correct probability. But to avoid a violation 
of causality, the expected cost of the simulation, in in- 
stances where no crossover occurs in a block of size n, 
must be at least n — log(l/Po); otherwise, as in the col- 
umn method, the Sender could use log(l/Po) + 0(l) cbits 
of additional classical communication to designate a no- 
crossover instance within a general simulation, thereby 
communicating n cbits about the input in less than n 
cbits of forward communication. For < p < 1/2 the 
causality-imposed cost n — log(l/Po) — n{l + log(l — p) 
exceeds the expected cost nC of an efficient simulation 
according to the Reverse Shannon Theorem; therefore 
in any efhcient exact simulation, 1) the worst case cost 
must be at least n — log(l/Po); and 2) the occurrence 
of a cost exceeding the expected cost nC must be nega- 
tively correlated with the number of crossovers, leaking 
extra information about the channel input besides that 
contained in the correctly simulated output. 

Resuming our discussion of obliviousness in r.s.p., we 
observe that the previously studied notions of oblivious- 
ness to the Receiver are exact, requiring that the pro- 
tocol leak no information whatever about the input. In 
the present paper's main context of approximate simula- 
tions it is more appropriate to use a more robust notion 
of approximate obliviousness: 

Definition 20 An r.s.p. protocol for a set X of states on 
K, is said to be approximate and approximately oblivious 
with parameters (e, S) if 

1. For all a G X, if the Receiver's output state is de- 
noted p^: \\\a - p^Wi < e. 

2. There exists a c.p.t.p. map T on the Receiver's sys- 
tem that maps his output state to a close ap- 
proximation of the whole of what he gets from the 
protocol: the pre-image of p^ ( under his decoding 
operation), possible residual quantum states, and 
the classical messages. I.e., 

-^\\{Rccciver's record] — T(p'^)||i < 5. 

Note that our notion of "approximate obliviousness" does 
not arise from some a priori concept of what the Re- 
ceiver must not learn. It is rather modelled after "zero- 
knowledge" in zero-knowledge proofs: the verifier gets 
nothing that he could not have simulated himself (see |27| 
and subsequent literature). 

Note that for e = (5 = we recover the definition of [s^ 
of a deterministic exact and exactly oblivious protocol. 
It would be natural to conjecture that a robust version 
of the main result of 34] should hold: 
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For an approximate and approximately obliv- 
ious r.s.p. protocol with parameters (e, 6) (for 
the set X = ^(/C) of all pure states on /C), the 
communication cost is > 2 — /(e, S) cbits per 
qubit, and it has to use > 1 ^ /(e, <5) ebits per 
qubit. There, / is a function that vanishes 
with e, (5 — > 0. 

Instead, it turns out that our protocol 11 is indeed ap- 
proximate and approximately oblivious in the sense of 
definition 1201 with parameters (e,e): 

Clearly, part (1) of the definition is satisfied (we re- 
move the failure event by having the Sender choose one 
uniformly distributed from the "good" messages in the 
case of a "failure"). Part (2) also is easily seen to be 
true: the simulating map is simply 

^ 1 _ 

k=l 

As an aside, we may return to the column-method, 
presented in example ^ (without recycling of entangle- 
ment): it is not hard to see that in fact also this procedure 
is approximate and approximately oblivious. Indeed, to 
simulate the Receiver's view of the protocol, he only has 
to create an arbitrary state, say (■^l)'^^ and an arbi- 
trary classical message (say, uniformly distributed) with 
probability e: this is to simulate the failure. With prob- 
ability each, he generates the states 

and the classical message k — 1, . . . , K. It is easily seen 
that this is e-close to the Receiver's actual view. 



C. Further applications of randomisation 
and trade— off r.s.p. 

The remote state preparation of state ensembles turns 
out to have applications to other problems, which we 
simply list here for reference: 

1. The protocol we described in section for opti- 
mal preparation of pure entangled states produces, when 
one ignores the Sender's half of the state, mixed states 
at the Receiver's system with a classical communication 
cost exactly equal to the Holevo quantity of his ensem- 
ble. This result is in fact the Quantum Reverse Shannon 
Theorem j6j| for cq~channels, and follows also from the 
alternative protocol described in [Tll |. 

2. Optimal remote state preparation of entangled 
states (section ^ is invoked to prove capacity formu- 
las and bounds for the classical communication capacity 
of bipartite unitaries assisted by unlimited or bounded 
entanglement 8, 30]. 

3. At the heart of our r.s.p. protocol is the state ran- 
domisation by relatively few unitaries (theorem ^ . In 



fact, similar to previously considered private quantum 
channels 0, Il2| we obtain a private channel scheme, 
but with halved key length! By applying the randomisa- 
tion to half of an entangled state, one even obtains very 
efficient schemes for data hiding in bipartite quantum 
states [22, . Our separate paper |^ is devoted to an 
exploration of these applications. 
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APPENDIX A: GAUSSIAN DISTRIBUTED 
VECTORS 

This appendix is largely a compilation of known 
facts about the distribution of random vectors follow- 
ing a Gaussian law, and of some of their moments: we 
freel y u se textbook knowledge of probability theory (see 
e.g. H^j), as well as parts of the treatment of large devi- 
ation theory by Dembo and Zeitouni [20l| . 

Recall that the Gaussian (or normal) distribution on 
the reals with mean /i and variance a^, denoted A^(/i, ct^), 
is defined by the density 

Ni^,,a^){dt} - -^e-^dt. 
V 27r(T^ 

We shall phrase most of the following in terms of ran- 
dom variables. That a random variable X is distributed 
according to some Gaussian is denoted X ^ N{fi, a^). 

Definition 21 A Gaussian complex number with mean 
/Lt S (D and variance > is a random variable 7 = 
X + iY , where X and Y are independent real random 

variables with X ^ N (lie 11, and Y ~ iV^Im/i, . 

Its distribution is denoted Af(c(/i, cr^). 

Note that in this definition we insist that real and imag- 
inary variance are equal, in contrast to the most general 
Gaussian distribution in ]R^. 



14 



Now let Ti he a. complex Hilbert space (of finite di- 
mension d). In general, a Gaussian distributed vector is 
a sum of the form |r) — J2j 7jki)i with an ortho normal 
basis {Iwj)} and independent Gaussian complex numbers 
7j N(£;{^j, cr|). Its distribution is uniquely determined 
by the mean = Ejr) and the covariance operator 
52 ^ E|r)(r| > 0: the density is given by 

Pr{|rHM) e \v)^''\w)} = ^^j^^^e-^^\^-'\^^d'^\w), 

with the unitarily and translationally invariant nor- 
malised volume element d w in n ~ R2d (J standard 
Lebesgue measure). 

However, we shall be interested only in the special case 
that all means fij = and all aj are equal. 

Definition 22 A symmetric Gaussian vector with vari- 
ance is a randomly distributed |r) G 7i such that in 
one orthonormal basis {\vj)} 

3 

with independent jj ^ iV^ (^fJ-j, . 

Equivalently, we could also define it by its covari- 
ance operator being E|r)(r| = From this it fol- 
lows that the distribution of T is unitarily invariant, 
hence in the above definition we can allow any orthonor- 
mal basis, a fact we shall make frequent use of. Note 
that — E(r|r). This distribution on H, is denoted 
AfH(0,a2). 

According to Cramer's theorem (see for its 
derivation in the present context: it requires only the 
"Bernstein trick" and Markov inequality), for i.i.d. real 
random variables X, Xi , . . . , Xn , 



with the rate function 



(Al) 



A* (a;) = sup [yx - InEe^-^] . 

For a squared Gaussian this can be evaluated explic- 
itly: 

Lemma 23 For X — , with a Gaussian variable Y ~ 
N{0,a'^), the rate function evaluates to 



1 00 



a; > 0, 
X < 0. 



Proof. First we calculate A(y) = InEe^-''^: 
1 



e-^dt 

VZtTCT^ J-oo 



V2t 



1 



1 



^1 - 2ycr2 y/2na^ 
1 



e 2^dT 



Hence 



Hy) 




Differentiation reveals one extremum of yx — A(y) at y = 
2o^ — ^ , which must be the maximum because yx — A{y) 
is upper bounded for a; > and — cx3 at both ends of the 
permissible interval of y. This yields the claim. □ 

Observe in particular, that EAT = ct^, so that we get 
for a = (1 -I- e)cr2 g^^^ ^ = (1 _ g')(j2 > q-j (jjjj. 



exp|^-A^ 
exp( -A^ 



£ - ln(l + e) 
2 In 2 

-e - ln(l - e 



21n2 



We shall make use of the following lower bound 
For all - 1 < ^ < 1 



(A2) 



^ (e-ln(l+a)> 



2 In 2 



121n2' 
,(A3) 

Proof is by Taylor expansion: for |^| = 1 it is obviously 
true, and for |^| < 1 we have 

^-in(i+o = e- 5](-i)"-i^ 



n=2 



E 

fc=i 



^E 

k=l 



^ r^2fe 



2k 2k + 1 



2k 2k + 1 



> 



APPENDIX B: STATE RANDOMISATION 

Proof of lemma Since the Haar measure is left and 
right invariant, we may assume that ip = |ei)(ei| and 
P = for some fixed orthonormal basis {|ei)}. 

Let iFj) = Z]iii5u|ei), where gij ^ A^c(0,l) are i.i.d. 
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(see appendix The distribution of \Tj) is the same as 
the distribution for ||2C/|ei) if U is chosen using the 
Haar measure. 

For fixed U — Uj and |r) = \Tj), the convexity of exp 
imphes that 



and all contained in the ball of radius 1 + e/4 centered at 
the origin. Therefore, 



m(e/4)2^ < (l + e/4) 



2D 



and we are done. 



□ 



ErexpU£|(e.|r)| 



EyErexpl ^Ml ^ |(e,,|t/|ei) 



D 



1=1 



>Eyexp(Er^f]|(e,|{/|ei> 



1=1 



= Mue^p(^yJ2\{e,\U\ei)f^ 

= E[/ exp(yTr(L/(^C/*P)). 

Invoking Cramer's theorem, this inequality between 
the moment generating functions establishes that 
i X]j=i Tr(J7(/9J7*P) converges to its mean value 

Ej,Tr(C/^C/*P) = Er^f] |(e,|r)|2 = | 



at least as quickly as 
p 

D 



n EE 



j=l i=l 



D' 

j=i j=i 



That is, the exponential rate function controlling 
large deviations of Tr{UipU* P) is at least as large as the 
corresponding function Ap for X]r=i 

The latter we have evaluated and estimated in sec- 
tional if |e| < 1, Ap(l + e) > ie^p and the result follows 
by an application of the union bound. □ 

Proof of lemma^ We begin by relating the trace norm 
to the Hilbert space norm: 



11^) -l-^) I 



= 2 

> 2 
= 2 

> 1 



- 2Re{iP\ip) 
1- /F(^) 



where the last line is a well-known relation between fi- 
delity and trace norm distance '2^ . Thus it will be suffi- 
cient to find an e/2-net for the Hilbert space norm. Let 
M — {l^fi) : 1 < i < m} be a maximal set of pure states 
satisfying \\\ipi) — \<fj)\\2 > e/2 for all i and j. By defini- 
tion, A4 is an e/2-net for || • II2. We can estimate m by a 
volume argument, however. As subsets of R^'^, the open 
balls of radius e/4 about each \ipi) are pairwise disjoint 



APPENDIX C: UNIVERSAL 
QUANTUM-CLASSICAL STATE DESCRIPTION 

In section IIIII we reduced universal r.s.p. with httle 
entanglement resources to universal visible quantum data 
compression with the same amount of qubit resources. 
Here we study the latter question. 

For a Hilbert space /C of dimension D a (univer- 
sal) quantum-classical state compression (or quantum- 
classical state description) of fidelity F consists of the 
following: first, a map 

mapping every pure state vector € /C to a pair (^, to), 
where |(^) € C is a state vector in the (quantum) code 
space and to is a classical message from the set M. Sec- 
ond, a family of completely positive and trace preserving 
linear maps 



D„, : B(C) S(/C), 



such that 



We call such a compression/description "universal" be- 
cause it has to have high fidelity for every possible input 
pure state. Note that both the quantum and classical 
parts of the state description are of fixed size, in contrast 
to variable-length coding schemes existing in classical 
and quantum data compression, for which the qualifier 
"universal" has a quite different meaning: there it means 
that the encoding of a state has the minimal possible 
length according to some standard. Here we are inter- 
ested in how the two resources we have trade against 
each other, in a "universal" way. 

There are two extreme examples. One is "no classical 
message", i.e. = 1 and a D-dimensional C ~ /C: for 
this the Sender simply prepares the desired state ^ in C. 
On the other end, dimC = 1 (i.e., no quantum message), 
in which case one can achieve fidelity 1 — e by identifying 
an element of an e-net in /C: by lemma 0] this requires 
(4 -I- log \) D cbits. 

The following theorem says that there occurs a jump in 
going from one extreme to the other, in the sense that as 
soon as the quantum resources are less than logD qubits, 
an exponential number of classical bits are needed: 

Theorem 24 A quantum-classical state compression 
with average fidelity F : 



d|v)i^(^,^™(v,)(^(V'))) 
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which uses a code space C of dimension S < qD (q < F), 
requires exponential classical resources: 



\og\M\>^^^^-^D-2\ogD + \og 1^1-^1— . 

Proof. Write the fidelity F — 1 — e and define 

5™ := { 1^) e K.\3\^) e C F{T^{cl>), ^j) > 1 - ^} , 

the set of pure states which can be reached to fideUty 
1 — z9 using the message m and some quantum code state. 
Clearly, S := lJ,„g_A^ Sm is the set of all states which can 
be decoded with fidelity 1 — i?. By Markov's inequality, 

where A is the unique Zi(-D)-invariant measure on pure 
states, normalised to 1 (i.e., a probability measure), and 
with t := ^ > 1 and d = ^/te. 

Hence, to prove a lower bound on \A4\, it will be suf- 
ficient to prove an upper bound on the volume X{Sm) of 
the sets Sm- 

We concentrate on a particular message m for the time 
being, so we drop the subscript m in the sequel. The 
decoding operation T : B{C) — > B{IC) can be written, by 
a result of Choi [lal , as 



with linear operators Ai : C ^ K,. Hence we can write 



with probabilities pi and pure state vectors \<f>i) S AiC =: 
Wi, the latter an (at most) S'-dimensional subspace of K.. 
But if F{T{(f>),tp) > 1 — e, there must exist i such that 
F{4'ii V") ^ 1 ~ £j by bilinearity of the pure state fidelity. 
Hence, 



(CI) 



with 



B,{W) :={|7/^)|3|(/))e>V 1(7/^10) |2>l-e}. 



and it will be sufficient to bound the volume of B^CW) 
for an arbitrary S'-dimensional subspace W: 

Denoting the orthogonal projector onto W by P, we 
can rewrite Bg{yV) as 

i3,(W) = {|^)|Tr(|V;)(V|P)> 



Also, since the volume A is a probability measure, we 
have 

X{B,{W)) - Pr{|7/.)|Tr(|V')(Vl^) > 1 - e} 

= Pr{C/|Tr(;7|0)(0|;7*P) > 1 - e} , 

with Z^(I?)-uniformly distributed unit vector lip) and a 
unitary U distributed according to Haar measure. Ob- 
serving that the expectation of the overlap Tr(|'0)('0|P) 
above is q, and defining 



r; := mm 



|i— ^-l,l| >\/t^. 



we can use lemma |21 to bound this probability by 



exp 



^ 6 



so using the union bound in eq. IjCljl we have 



A(5) < exp 
which implies what we wanted 

2 

loglXI > ^D^2logD- 
6 



-qD 



log 1 



'1~F 
1-9, 



□ 



Remark 25 There exists a universal quantum-classical 
state compression with fidelity > (1 — e)^, which uses a 
code space C of dimension S ~ [(l — |)Z3] and classical 
communication of \e^^~\ chits. 

This works as follows: decompose K, into orthogonal 
suhspaces Hk (k = 0, . . . ,K = \e~^~\ ), such that 



diniTYo < dim Til 



dim Hk 



Write Pk for the projectors onto the orthogonal comple- 
ment of Hk : then 



1 



K 



K ^ 

k=\ 



Pk>\\ 



1 

'k 



> (1-e)^, 



which means that for every state vector if) the Sender can 
find 1 < k < K such that Tr(|i/>)(V'|Pfc) > 1 - e. The 
Sender simply transmits the projected quantum state and 
k, from which the Receiver can reconstruct ip to the de- 
sired fidelity. The rank of the Pk determines S, which is 
easily estimated. □ 

This result is in contrast to the findings of , where for 
the asymptotic compression of longer and longer prod- 
ucts of qubits (or qu-d-its in general) a rate trade-off 
between qubits and cbits was exhibited. In the light of 
the present theorem we can understand how that comes 
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about: the model of |29| admits only product states in 
larger and larger spaces. The trade-ofF curve then quan- 
tifies how efficiently the manifold of product states can 
be covered by (neighbourhoods of) small subspaces. 

Once we admit all states in dimension D, this covering, 
instead of using polynomially (in D) many subspaces, 
requires exponentially (in D) many! 



APPENDIX D: TYPICAL SUBSPACES 

The following material can be found in most textbooks 
on information theory, e.g. [T^ Il8| . or in the original 
literature on quantum information theory |33ll37ir38ll40l |. 

For strings of length n from a finite alphabet X, which 
we generically denote € A"", we define the 

type of x"" as the empirical distribution of letters in x": 
i.e., P is the type of a;" if 

yxeX P{x)^-\{k:xk=x}\. 
n 

It is easy to see that the total number of types is upper 
bounded by (n + l)l'*l. 

The type class of P, denoted Tp, is defined as all 
strings of length n of type P. Obviously, the type class 
is obtained by taking all permutations of an arbitrary 
string of type P. 

The following is an elementary property of the type 
class: 

(n + l)-l'^lexp(nff(P)) < \T^\ < exp(niJ(P)), (Dl) 

with the (Shannon) entropy H{P). 

For S > 0, and for an arbitrary probability distribution 
P, define the set of P-typical sequences as 



7 '71 
P.5 ■ — 



-\0gP' 

n 



{xn-H{P) 



< S 



By the law of large numbers, for every e > and suffi- 
ciently large n, 



p'^'^rps) > l-e. 



Furthermore: 



|r;;,| <exp(n(ff(p) + ^)), 

|r^:,|>(l-6)exp(n(i/(P)-5)). 



(D2) 

(D3) 
(D4) 



For a (classical) channel W : X — > y (i.e. a stochastic 
map, taking a; e A" to a probability distribution Wx on 
y) and a string a;" G A"" of type P we denote the output 
distribution of in n independent uses of the channel 
by 



■Wx 



Let (5 > 0, and define the set of conditional W -typical 
sequences as 



^,5(2^") 



y 



-ilogM/,"„(j/") 
n 



H{W\P) 



< S 



where H{W\P) = P{x)H{Wx) is the conditional en- 
tropy. 

Once more by the law of large numbers, for every e and 
sufficiently large n. 



H^;„(T^,,(x")) >l-e. 



Furthermore: 



^^six")\<exp{niHiW\P) + S)), 
e) exp{n{H{W\P) 



(D5) 

(D6) 
(D7) 



All of these concepts and formulas have analogues as 
"typical projectors" IT for quantum state: by virtue of 
the spectral decomposition, the eigenvalues of a density 
operator can be interpreted as a probability distribution 
over eigenstates. The subspaces spanned by the typi- 
cal eigenstates are the "typical subspaces" . The trace of 
a density operator with one of its typical projectors is 
then the probability of the corresponding set of typical 
sequences. 

Notations like 11" 5, 11^ ^(i") etc. for a state p and a 
cq-channel Lp should be clear from this. 

There is only one such statement for density operators 
that we shall use, which is not of this form: 

Lemma 26 (Operator law of large numbers) Let 

e A"" he of type P, and let W : X — > S{n) be a 
cq-channel. Denote the average output state of W under 
P as 

p = Y,pi^)Wx. 

X 

Then, for every e > and sufficiently large n, 

Tr(W^,"„n^,,) > 1 - e. 
Proof. See Lemma 6. □ 



APPENDIX E: A POSSIBLE OPERATIONAL 
REDUCTION OF R.S.P. TO Q.C.T. 



Our protocol in section IIVI for (asymptotic) remote 
state preparation of ensembles reduces the problem to the 
quantum-classical trade-off in visible source coding 
by an operational reduction: we simply add our universal 
r.s.p. protocol, theorem|Sl on top of the q.c.t. coding, the- 
orem O The optimality proof, though modelled closely 
along the lines of the corresponding proof in [2^ , is how- 
ever completely independent. It would be desirable to 
have a closer connection between the trading of qubits 
vs. cbits and of ebits vs. cbits, and in this appendix we 
describe an operational link going the other way, from 
r.s.p. to q.c.t., resting on an (as yet unproven) conjec- 
ture on mixed-state compression: 

More precisely, given an r.s.p. protocol (asymptotic 
and approximate) of cbit rate C and ebit rate E con- 
struct a q.c.t. scheme with cbit rate R = C — E and qubit 
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rate Q = E. This would exactly revert the construction 
of section HVI 

We will prove that this is possible, assuming the fol- 
lowing conjecture (see and 0): 

Conjecture 27 Given an i.i.d. source T = of 
mixed states it is possible to visibly compress the source 
asymptotically and approximately, using shared random- 
ness between Sender and Receiver, and communicating 
qubits at rate 

Note that this is true if the ensemble consists of pur e 
states, by Schumacher's quantum data compression |37l |. 
Also observe that the conjecture certainly is true for com- 
muting mixed states: this is essentially the content of the 
Reverse Shannon Theorem Ji^], see also .41.j . 

Note (as we have observed earlier) that shared ran- 
domness can safely be assumed free, because we are con- 
sidering an average pure state fidelity as quality measure 
of the protocol. 

We assume the following general form of our r.s.p. pro- 
tocol: it uses a standard maximally entangled state |<i>) 
on Ka® TCb, with dim/C < 2"(^+^). Depending on 
/ — ii. . .in the Sender makes a measurement on ICa, 

described by a POVM A^-^) = (a^^) , where m is the 

message she subsequently sends to the Receiver, chosen 
from a set of M < 2'^^^'^^\ Of course, as n tends to 
infinity, 5 will tend to zero. For each of the messages to, 
the Receiver can execute an operation Tm on Kb, act- 
ing on the state induced by the entanglement and the 
measurement, together with the outcome, denoted Pm\i- 
Denote the induced probability of the message to (given 
/) as q{m\I). We shall only assume the "local" fidelity 
condition, eq. ©, not the stronger "global" one, eq. |(2J). 

Our goal is to re-enact the creation of the post- 
measurement state and the transmission of the classical 
message using only cbit and qubit communications. The 
key idea comes from the observation that there is noise 
in the system due to the uncontrollable randomness of 
the POVMs. We want to transfer the generation of this 
noise to the shared randomness. 

We shall now look at blocks formed from the n-blocks 
given by the assumed r.s.p. protocol. We use the previ- 
ous notation I — ii . . .in for an n-block, and introduce 
= Ii . . . In for such a block of blocks. By the Reverse 
Shannon Theorem (in the formulation of |41j]) we can vis- 
ibly encode the distribution q{-\I^), at least for typical 

, using shared randomness and communicating 

I(/:to) =i?(TO)-^pzi/(q(.|/)) 
/ 

<n{R + S)-Y,PlH{qm) 
I 

cbits per n-block, where we treat / and to as jointly 



distributed random variables: 

Pr{/, to} = piq{m\I), 

with H is the usual Shannon entropy, and I the Shannon 
mutual information. 

A feature of the Reverse Shannon Theorem that was 
noted earlier is that the Sender gets full feedback, i.e. she 
obtains the very (random) message to the Receiver gets 
out. With the help of this feedback, she just prepares 
the post-measurement state on /C that otherwise the Re- 
ceiver would have found on his half of the entanglement, 
and sends it. Then, obviously, the Receiver can proceed 
as in the r.s.p. protocol. It is clear, that we end up with 
a procedure having high fidelity according to the "local" 
fidelity criterion eq. ©, now over a block of length Nn. 

How does this behave in terms of resources? Clearly, 
we now use only qubits and cbits. Inspection of the above 
formulas reveals that all is fine if 

J2piH{qm)>niE-S'), (El) 

with 5' = o(l) asn oo. Because then we have a 
q.c.t. scheme (satisfying eq. (O) that uses Nn{E -\- 5) 
qubits and Nn{R — E + 5 + (5')_cbits. This is exactly the 
reduction we wanted: since in 29] the trade-off curve was 
(implicitly) proved for the criterion cq. ((JJ, we obtain the 
desired bounds on E and R. 

We are left with proving that assuming the negation 
of eq. HEip leads to a contradiction: so, introducing the 
tripartite state 

/ m 

for notational convenience, assume that there exists 
/S.E > such for all large n 

S{B:C\A)<S{C\A)<n{E^AE). (E2) 

The right inequality is the negation of eq. (|E1|) . and 
the left is by data processing: for each value of / in A 
the information between B and C (which is the Holevo 
quantity of the ensemble {q{-\I), p.\i}) is upper bounded 
by the entropy of C, i.e. H{q{-\I)). 

Note further that, because J2m Pm\i equals the 

maximally mixed state for all /, we have S{A : B) = 0, 
hence by the chain rule for quantum mutual information, 

S{B : C\A) = S{AC : B). 

Thus, for large enough N , we can, by conjecture |^ 
encode iV-blocks of the Pra\i using shared randomness 
and sending 

NS{AC : B) + o{N) = NS{B : C\A) + o{N) 
< Nn{E - AE) + o{N) 

qubits: the conjecture is applied to the ensemble 
{piq{m\I); Pm\i}, which partly is given (the input, /) and 
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which partly is obtained by simulating the noisy classical 
channel q{-\-) (the variable m). Observe that m is by this 
method generated simultaneously at the Sender and at 
the Receiver. 

Switching back to r.s.p. via eq. lO we end up with a 
protocol on A^n-blocks using only Nn{E — AE) + o{N) 
ebits and 

NS{A : C) + NS{B : C\A) + o{N) 

= NS{AB : C) + o{N) < Nn{R + o(l)) 

cbits: the first term is due to the communication cost 
of the Reverse Shannon Theorem, and the second is the 
cost overhead to remotely prepare the NS{B : C\A) + 
o{N) qubits of the compressed mixed states. In the limit 
this leads to a rate pair {R,E — AE), contradicting the 
optimality of {R, E) . □ 

APPENDIX F: MISCELLANEOUS PROOFS 

Proof of lemma ligl For finiteness of the values of N 
we have to have R > S{A : B) — S{B), which is clearly 
sufficient. For N{£, i?) = on the other hand, one has to 
have a state with = S{A : B\C) = S{B\C). But then, 

R>S{A: BC) 

= S{A : C) + S{A : B\C) = S{A : C). 

However, S{B\C) = says that _B is in a pure state 
given C, which is only possible if S{A\C) — 0. Hence 
R > S{A), which clearly is sufficient, too. 

For convexity, let Wi be optimal for uj2 optimal for 
i?2, i-e. 

S^,{A:B\C)^N{Rk), 
S^,{A- BC) <Rk, 

k = 1,2. Furthermore, let < A < 1. Then form the 
state 

uj = Xuji(g) \l){lf' + (1 - \)uj2 ® |2)(2|^'. 

By definition (with C ^ CC), 

SUA : BC) < XRi + {1 - X)R2, 
SUA : B\C) = XN{Ri) + (1 - A)iV(i?2), 

and thus the minimisation yields 

iV(Ai?i + (1 - A)i?2) < XN{Ri) + (1 - X)N{R2). 

Taking i?i — S{B) and i?2 = S{A), we obtain that in 
the interval [S{B); S{A)] is strictly decreasing and con- 
tinuous — otherwise there were a contradiction to con- 
vexity (Note that A^(i?2) = 0!) 

Finally, for the additivity relation, eq. JS}, observe that 
"<" is almost obvious: if are optimal for (£fc,i?fe), 
k = 1,2, it is immediate to check that lu — uji uj2 is 



feasible for {£i £2, R = Ri + R2), implying an upper 
bound of N{£i,Rj_) + N(£2, R2) for 7V(f 1 £2, -R)- 
In the other direction, let w be optimal for (£1 ^£2, R)'- 

c.=^p,p:;,iz)(*i-^^®i*')(*'i^v^®^f^®^p(j-izz')ij)(jr. 

i.i' j 

First, by the chain rule and data processing, 

R > SiAiA2 : B2B2C) 

= S{A^ : B1B2C) + S{A2 : S1S2CIA1) 

> S{A,:B,C) + S{A2:B2C\Ai). 

Thus we can write R ^ Ri + R2 such that 

S{Ai : BiC) < Ru SiA2 : B2C\Ai) < R2. (Fl) 

Second, by a similar reasoning, 

N{£i ® £2, i?) = S{AiA2 : B2B2IC) 

= S{Ai : BiB2\C) + S{A2 : B,B2\CA,) 
>S{Ai : Bi\C) + S{A2: B2\CAi). 

Here, the first term is > N{£i,Ri) by definition, using 
eq. HI^'lll . The second term is similarly > TV (£2, ^2), using 
additionally the convexity of N. □ 

Proof of lemma \1!A Monotonicity follows directly from 
the definition. 

For finite values we obviously have to have 

R > S{X : BC) > S{X : B). 

Also always (using that the conditional entropy can only 
increase under quantum operations — a consequence of 
strong subadditivity) , 

E>S{B\C) > S{B\X), 

with equality when C contains a copy of X. 

Convexity is proved exactly as in the proof of 
lemma [T^ From this continuity in the domain of finite 
values follows, as well as strict monotonicity as long as 
NiR) > SiB\X). 

It remains to prove the additivity relation, eq. H18|l : 
"<" is the trivial inequality, after the pattern of the proof 
of lemma II 21 As for ">", consider an optimal state ui for 
£1 (g) £2 and rate R: 

j 

Then, using the chain rule, data processing, and the in- 
dependence of Xi and X2 , 

R > S{XiX2 : B1B2C) 

- S{Xi : B1B2C) + S{X2 : BiB2C\Xi) 

> S{Xi : BiC) + S{X2 : B2C\Xi) 
= S{Xi : BiC) + S{X2 : B2CX1), 
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so we can find Ri and R2 such that Ri + R2 = R and 

S{Xi : BiC) < Ri, S{X2: B2CX1) <R2. 

On the other hand, 

N{£i<»£2)^S{BiB2\C) 

^ S{Bi\C) + S{B2\CBi) 
>S{Bi\C) + S{B2\CXi), 
> N{£i,Ri) + N{£2,R2) 



where in the third hne we have used that conditional 
entropy can only increase under quantum operations, a 
consequence of strong subadditivity. The last line follows 
because with our choice of i?i and R2, C and CXi are 
permitted in the definition of N{£i,Ri) and N{£2,R2), 
respectively. □ 
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